Tony Wang7 min readWe Fingerprinted the Top 1,000,000 Websites. The Top 1,000 Run a Completely Different Stack.
Split our 965K-site tech-stack census by Tranco rank: bot management and React frameworks concentrate at the top, WordPress dominates the tail.
A million-domain census answers "what does the internet run on" the same way a national census answers "what does the average citizen earn" — technically true, and hiding almost everything interesting. Split the same 965,200-site fingerprint by how much traffic each domain actually gets, and two pairs of numbers move in opposite directions at once: the technologies you'd associate with well-funded, professionally engineered sites concentrate hard at the top, while the technologies you'd associate with the self-serve, managed-platform web climb the further down the list you go.
The stack flips as you go down the list
| Tranco rank band | Bot management | React frameworks | WordPress | Cloudflare CDN |
|---|---|---|---|---|
| Top 1,000 | 23.2% | 14.8% | 7.3% | 22.5% |
| 1K–10K | 16.9% | 13.0% | 10.1% | 33.3% |
| 10K–100K | 11.3% | 10.3% | 15.4% | 39.8% |
| 100K–1M | 7.0% | 5.9% | 19.3% | 45.7% |
Two things fall together and two things rise together, and it isn't a coincidence. Enterprise bot management (DataDome, PerimeterX, Akamai Bot Manager, Kasada, or Cloudflare's own paid tier) and modern React meta-frameworks (Next.js and its siblings) are both, in practice, decisions that take engineering budget and traffic that justifies the spend — a site fighting off scrapers at scale is usually also a site that can afford a dedicated frontend team. WordPress and Cloudflare's free-tier CDN are the opposite: the default choice when a site owner wants something that works without a platform team behind it, which describes the overwhelming majority of the million-domain tail far more than it describes the top 1,000.
An independent confirmation, measured a completely different way
Strip Cloudflare's own bot-management product out of the picture — leaving only the specialist enterprise vendors (DataDome, Akamai Bot Manager, Kasada, PerimeterX) — and this static-HTML fingerprint pass lines up with a dataset built for an entirely different purpose: Crawlora's own Anti-Bot Adoption Index, which measures active challenge behavior (does a probe actually get blocked or challenged) rather than reading a script tag off the homepage.
| Tranco rank band | Tech Stack dataset | Anti-Bot Index |
|---|---|---|
| Top 1,000 | 9.8% | 7.6% |
| 1K–10K | 5.6% | 5.3% |
| 10K–100K | 2.8% | 2.6% |
| 100K–1M | 0.7% | 0.6% |
Both datasets fall roughly 13–14× from the top of the list to the tail, and every band lands within 1–2 points of the other despite being scanned at different times, with different detector code, by different methods (a passive script/header read here, an active probe there). That's the same cross-validation trick as our CAPTCHA cross-check in the parent post — two independent measurements agreeing is much stronger evidence than either one alone that "enterprise bot management is a head phenomenon" is real, not a detector artifact.
The biggest sites are actually the leanest
If you assumed the biggest sites on the internet run the most third-party tooling — the most trackers, the most widgets, the most vendor sprawl — the data says the opposite. The top 1,000 average 5.24 detected technologies per homepage; the 100K–1M tail averages 6.42. A plausible read: the very top of the web includes a disproportionate share of infrastructure itself (search engines, CDNs, cloud consoles, other companies' own APIs) that deliberately runs minimal third-party code, while a mid-tier commercial site loaded with every marketing tool its team has ever purchased is a far more typical shape for "large audience, unremarkable engineering discipline."
What BuiltWith charges $295 a month for
BuiltWith's "Market Analysis" product segments technology adoption by exactly this cut — top 10K, top 100K, top 1M — and gates it behind a paid plan starting at $295/month (Pro: $495, Team: $995). The segmentation above is the same idea, computed from Crawlora's own open Tranco census instead of BuiltWith's proprietary crawl, and published here for free. If you need the underlying per-domain records rather than the aggregate curve, the full dataset is one REST API call away.
Limits, stated plainly
The top-1,000 band has the smallest sample (n=737 reachable), so read its exact percentages as directional, not decimal-precise — a handful of domains moving between "has a detector match" and "doesn't" swings a percentage point at that scale far more than it would in the 694,413-domain tail. This is also correlation, not causation: using Next.js doesn't cause a site to get more traffic, and running WordPress doesn't cause it to get less. The far more likely direction of causality runs the other way — well-funded organizations independently choose both a modern engineering stack and already operate at a scale that draws automated traffic worth defending, while a small or resource-constrained site reaches for whichever platform bundles hosting, security, and content management into one product it doesn't have to assemble itself. And as with the parent census, this is a homepage-only, HTTP-tier fingerprint — it sees what a plain request to / returns, not what loads behind a login or on a checkout page.
Query the full Tech Stack dataset
965,200 fingerprinted domains — CDN, CMS, ecommerce, analytics, web server and more — over one REST API, ranked by Tranco traffic rank.
Frequently asked questions
Do the biggest websites run more third-party technology than smaller ones?
No - the opposite. In Crawlora's 965,200-site tech-stack census, the top 1,000 sites by Tranco rank average 5.24 detected technologies per homepage, while the 100K-1M tail averages 6.42. The largest sites tend to be leaner, not more instrumented; a lot of the very top of the web is infrastructure (search engines, clouds, other companies' APIs) that runs minimal third-party code by design.
Does enterprise bot management concentrate at high-traffic sites?
Yes, sharply. Enterprise bot-management vendors (Cloudflare Bot Management, PerimeterX, DataDome, Akamai Bot Manager, Kasada) protect 23.2% of the top 1,000 sites by Tranco rank, falling to 7.0% of the 100K-1M tail - a 3.3x gradient. Excluding Cloudflare specifically, this independently matches Crawlora's separately-run Anti-Bot Adoption Index (a different, challenge-response-based detection method): 9.8% to 0.7% here vs. 7.6% to 0.6% there.
Does WordPress usage vary by site traffic rank?
Yes, in the opposite direction from bot management. WordPress runs 7.3% of the top 1,000 Tranco-ranked sites, climbing to 19.3% of the 100K-1M tail - a 2.6x increase. Cloudflare's own (free-tier) CDN follows the same rising pattern, 22.5% to 45.7%, even as Cloudflare's own paid bot-management product falls with rank.
Do React frameworks like Next.js concentrate at high-traffic sites?
Yes. React meta-frameworks (Next.js, Nuxt.js, Astro, Gatsby, SvelteKit, Remix) run 14.8% of the top 1,000 Tranco-ranked sites, falling to 5.9% of the 100K-1M tail - a 2.5x gradient, the same direction as enterprise bot management and the opposite direction from WordPress.
How is technology adoption segmented by website traffic rank normally measured?
BuiltWith's paid "Market Analysis" product segments technology adoption by top-10K/100K/1M Tranco-style rank bands, starting at $295/month. Crawlora computes the same kind of segmentation from its own open Tranco top-1M tech-stack census and publishes it for free.